# Semgrep: how AI models rank it, September 2026

IT AI Recommendation Index, September 2026 Edition. Named in 63 judge labels across 3 categories by 12 of 12 models. Page: https://it-ai-index.com/vendors/semgrep/

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| Static application security testing | 47% | 1 | 0% | 56 |
| Software composition analysis | 0% | 24 | 17% | 6 |
| Vulnerability management platforms | 0% | 46 | 0% | 1 |

## What the models said for it

- "For Developer-First Speed & Flexibility: Semgrep Code or Snyk Code. They are incredibly fast, have great PR integration, and are built around developer workflows." (Gemini 3.5 Flash, SAST)
- "The best SAST tool for a company with a limited budget is Semgrep CE, which is a free SAST scanner that supports 30+ languages" (Llama 4 Maverick, SAST)
- "I recommend Semgrep (specifically the Semgrep AppSec Platform) as your primary static code security scanner." (GLM 4.7 FlashX, SAST)
- "look toward modern semantic analyzers like Semgrep or Snyk, which prioritize developer workflows and speed" (Gemini 3.5 Flash, SAST)

## And against it

- "OSS-focused limits; not full SCA for all needs" (Grok 4.1 Fast, SCA)

## Record

- Method: https://it-ai-index.com/methodology/
- Raw judge labels and full responses: https://it-ai-index.com/data/
- License: CC BY 4.0. Cite as IT AI Recommendation Index, September 2026 Edition, it-ai-index.com.